Currently, comments are available to anyone who can view a paper's abstract. There should be an option to optionally restrict comments to registered users as well -- available in Website Management Step 1.5. If "Require registration to attend the conference" is chosen, there should be an additional checkbox under it to "Restrict viewing and writing comments to registrants only".
This should also be applied to OJS' comment feature, as non-subscribed users can currently read comments.
(Courtesy of Vicente)